Privacy & Cookie Policy
Last updated: 4 July 2026
Who we are
Softy Ltd is the data controller for personal data collected through this website. If you have any questions about this policy or how we handle your data, contact us at privacy@softyltd.co.uk.
Information we collect
Contact form enquiries
When you submit the contact form, we collect your name, email address, and message. We use this to respond to your enquiry. The lawful basis is legitimate interest — we have a legitimate interest in responding to business enquiries sent to us.
Form submissions are delivered via Resend and retained for 30 days, after which they are deleted.
Analytics (with your consent)
If you accept analytics cookies, we use Google Analytics 4 (GA4) via Google Tag Manager to understand how visitors use our site. GA4 collects data including pages viewed, time spent on site, browser and device type, and approximate location (country and city level). GA4 does not collect your name, email address, or other directly identifiable information. IP addresses are processed briefly to determine approximate location and are then discarded. The lawful basis is consent.
You can withdraw consent at any time using the cookie settings link at the bottom of this page.
If you become a Softy customer
If you sign up for a Softy service, we collect further personal data from you as our customer (rather than as a visitor to this website), to set up billing and execute our service agreement.
Billing (direct debit)
To collect the monthly subscription fee, we collect your name, email address, and bank account details (sort code and account number) via GoCardless, our direct debit payment collection provider. The lawful basis is performance of a contract — this data is necessary to collect payment under your service agreement with us.
We retain this data for 6 years after your relationship with us ends, in line with HMRC record-keeping requirements for business accounts.
Contract execution (e-signature)
When you sign our service agreement, we collect your name, email address, signature, IP address, and the date and time of signing via Signable, our e-signature provider. The lawful basis is performance of a contract and taking steps you request prior to entering into one.
We retain the signed agreement and its execution record for 6 years after your relationship with us ends, so we can rely on it if a dispute arises.
Cookies
We use a small number of cookies. Strictly necessary cookies are set automatically. Analytics cookies are only set with your consent.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
softy-cookie-consent | Stores your cookie consent preference | Strictly necessary | Until cleared |
_ga, _ga_* | Google Analytics — distinguishes users and sessions to measure site usage | Analytics (consent required) | Up to 2 years |
Who we share data with
We do not sell or rent your personal data. We use the following sub-processors, each acting only on our instructions:
- Resend — email delivery for contact form submissions
- Vercel — website hosting; processes visitor request data (IP address, request logs) in the normal course of serving the site
- Google Analytics — analytics processing, only when consent is given
- Signable — e-signature and contract execution, for customers only
Each sub-processor is bound by a Data Processing Agreement and applicable data protection law.
Resend, Vercel, and Google are based in the United States. Transfers of personal data to these providers are made under Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as required under UK GDPR, as set out in each provider's Data Processing Agreement. Signable is UK-based, with infrastructure in the UK; where any transfer outside the UK or EEA occurs, it is restricted to providers certified under the EU-US Data Privacy Framework.
GoCardless, which we use to collect the direct debit payment from customers, is not one of our sub-processors — it acts as an independent data controller in its own right for the payment data it handles, under its own terms and privacy notice. Its processing of European payments takes place on servers within the European Economic Area (EEA). You can read GoCardless's own privacy notice at gocardless.com/legal/gdpr.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Object to processing based on legitimate interest
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
To exercise any of these rights, email privacy@softyltd.co.uk.
Automated decision-making
We do not use your personal data for automated decision-making or profiling.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last revised. Continued use of the site after an update constitutes acceptance of the revised policy.